Overview
overview
7Static
static
164799a0a41...c0.exe
windows7-x64
764799a0a41...c0.exe
windows10-2004-x64
7$PLUGINSDI...OB.dll
windows7-x64
3$PLUGINSDI...OB.dll
windows10-2004-x64
3OfferBox.exe
windows7-x64
1OfferBox.exe
windows10-2004-x64
1OfferBoxBHO.dll
windows7-x64
6OfferBoxBHO.dll
windows10-2004-x64
6OfferboxCh...in.dll
windows7-x64
3OfferboxCh...in.dll
windows10-2004-x64
3background.html
windows7-x64
1background.html
windows10-2004-x64
1contentscript.js
windows7-x64
1contentscript.js
windows10-2004-x64
1OfferBoxEngine.dll
windows7-x64
1OfferBoxEngine.dll
windows10-2004-x64
1OfferBoxLauncher.exe
windows7-x64
1OfferBoxLauncher.exe
windows10-2004-x64
1offerboxff...nts.js
windows7-x64
1offerboxff...nts.js
windows10-2004-x64
1offerboxff...om.dll
windows7-x64
1offerboxff...om.dll
windows10-2004-x64
1Analysis
- max time kernel
141s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
18/01/2024, 04:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
64799a0a4118c6ccb56c8c8bd9dae0c0.exe
Resource
win7-20231215-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
64799a0a4118c6ccb56c8c8bd9dae0c0.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NsisPluginOB.dll
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NsisPluginOB.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
OfferBox.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
OfferBox.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
OfferBoxBHO.dll
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
OfferBoxBHO.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
OfferboxChromePlugin.dll
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
OfferboxChromePlugin.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
background.html
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral12
Sample
background.html
Resource
win10v2004-20231215-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral13
Sample
contentscript.js
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
contentscript.js
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
OfferBoxEngine.dll
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
OfferBoxEngine.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
OfferBoxLauncher.exe
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
OfferBoxLauncher.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
[email protected]/chrome/content/events.js
Resource
win7-20231129-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
[email protected]/chrome/content/events.js
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
[email protected]/components/OfferBoxXpCom.dll
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
[email protected]/components/OfferBoxXpCom.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 64799a0a4118c6ccb56c8c8bd9dae0c0.exe
- Size 1.7MB
- Sample240118-e5vlxscgbk
- SHA256 a148412a5c1cc9aba0ecdbb3e44010aeac75b40f23492bd04c0127e558aa44ac
- MD5 64799a0a4118c6ccb56c8c8bd9dae0c0
- SHA1 bcd05bf2b8a1e6920f3fb936f51676b90d00fe27
- SHA512 ae9c6e7ed1ffbd5ba864655de638c917dda149be41559d21eabc9236ab887158a89770f28e6fdb5f95b659c3415cd4722c71c23d1fa1d56d8e6d6acfd2e4a49e
- SSDEEP 49152:NFHplMNmSOZZSctRqhzS+sGjP5rUBBO4xOAL:Nlp6mSOZsctizzHjxUBH
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 4424 OfferBox.exe 3756 OfferBoxLauncher.exe 3868 OfferBox.exe - Loads dropped DLL 5 IoCs
pid Process 4424 OfferBox.exe 1208 64799a0a4118c6ccb56c8c8bd9dae0c0.exe 1208 64799a0a4118c6ccb56c8c8bd9dae0c0.exe 1208 64799a0a4118c6ccb56c8c8bd9dae0c0.exe 3868 OfferBox.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FC0D62C2-9640-4AEB-A5D5-CF25DF11FA8C} 64799a0a4118c6ccb56c8c8bd9dae0c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FC0D62C2-9640-4AEB-A5D5-CF25DF11FA8C}\ = "OfferBox" 64799a0a4118c6ccb56c8c8bd9dae0c0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FC0D62C2-9640-4AEB-A5D5-CF25DF11FA8C}\NoExplorer = "49" 64799a0a4118c6ccb56c8c8bd9dae0c0.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File created C:\Program Files (x86)\OfferBox\OfferBoxBHO.dll 64799a0a4118c6ccb56c8c8bd9dae0c0.exe File created C:\Program Files (x86)\OfferBox\OfferBoxEngine.dll 64799a0a4118c6ccb56c8c8bd9dae0c0.exe File created C:\Program Files (x86)\OfferBox\res\language.xml 64799a0a4118c6ccb56c8c8bd9dae0c0.exe File created C:\Program Files (x86)\OfferBox\uninst.exe 64799a0a4118c6ccb56c8c8bd9dae0c0.exe File created C:\Program Files (x86)\OfferBox\OfferBox.exe 64799a0a4118c6ccb56c8c8bd9dae0c0.exe File created C:\Program Files (x86)\OfferBox\[email protected]\components\OfferBoxXpCom.dll 64799a0a4118c6ccb56c8c8bd9dae0c0.exe File created C:\Program Files (x86)\OfferBox\[email protected]\chrome.manifest 64799a0a4118c6ccb56c8c8bd9dae0c0.exe File created C:\Program Files (x86)\OfferBox\[email protected]\install.rdf 64799a0a4118c6ccb56c8c8bd9dae0c0.exe File created C:\Program Files (x86)\OfferBox\[email protected]\components\OfferBoxXpCom.xpt 64799a0a4118c6ccb56c8c8bd9dae0c0.exe File created C:\Program Files (x86)\OfferBox\OfferBoxLauncher.exe 64799a0a4118c6ccb56c8c8bd9dae0c0.exe File created C:\Program Files (x86)\OfferBox\OfferBoxChromeExtension.crx 64799a0a4118c6ccb56c8c8bd9dae0c0.exe File created C:\Program Files (x86)\OfferBox\[email protected]\chrome\content\overlay.xul 64799a0a4118c6ccb56c8c8bd9dae0c0.exe File created C:\Program Files (x86)\OfferBox\res\loader.gif 64799a0a4118c6ccb56c8c8bd9dae0c0.exe File created C:\Program Files (x86)\OfferBox\[email protected]\chrome\content\events.js 64799a0a4118c6ccb56c8c8bd9dae0c0.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{37F4A335-D085-423e-A425-0370799166FB} 64799a0a4118c6ccb56c8c8bd9dae0c0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{37F4A335-D085-423e-A425-0370799166FB}\Policy = "3" 64799a0a4118c6ccb56c8c8bd9dae0c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{37F4A335-D085-423e-A425-0370799166FB}\AppName = "OfferBox.exe" 64799a0a4118c6ccb56c8c8bd9dae0c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{37F4A335-D085-423e-A425-0370799166FB}\AppPath = "C:\\Program Files (x86)\\OfferBox" 64799a0a4118c6ccb56c8c8bd9dae0c0.exe - Modifies registry class 50 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED85AEBE-F834-4088-B5D3-97EB2478A6CD}\1.0\0\win32\ = "C:\\Program Files (x86)\\OfferBox\\OfferBox.exe" OfferBox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6612AFDD-34AD-4B89-A236-7E6D07C3FDCD}\ = "IOfferBoxServer" OfferBox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FC0D62C2-9640-4AEB-A5D5-CF25DF11FA8C}\InProcServer32\ = "C:\\Program Files (x86)\\OfferBox\\OfferBoxBHO.dll" 64799a0a4118c6ccb56c8c8bd9dae0c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED85AEBE-F834-4088-B5D3-97EB2478A6CD}\1.0\ = "OfferBox" OfferBox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED85AEBE-F834-4088-B5D3-97EB2478A6CD}\1.0\0 OfferBox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A7E8C343-7860-4A95-9AA8-AAF30D0F6D1E}\LocalServer32 OfferBox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6612AFDD-34AD-4B89-A236-7E6D07C3FDCD}\TypeLib\Version = "1.0" OfferBox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A7E8C343-7860-4A95-9AA8-AAF30D0F6D1E}\TypeLib OfferBox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED85AEBE-F834-4088-B5D3-97EB2478A6CD}\1.0\HELPDIR OfferBox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6612AFDD-34AD-4B89-A236-7E6D07C3FDCD} OfferBox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6612AFDD-34AD-4B89-A236-7E6D07C3FDCD}\TypeLib\Version = "1.0" OfferBox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6612AFDD-34AD-4B89-A236-7E6D07C3FDCD}\TypeLib OfferBox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6612AFDD-34AD-4B89-A236-7E6D07C3FDCD}\ProxyStubClsid32 OfferBox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OfferBox.OfferBoxServer.1\ = "OfferBoxServer Class" OfferBox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OfferBox.OfferBoxServer OfferBox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A7E8C343-7860-4A95-9AA8-AAF30D0F6D1E}\ = "OfferBoxServer Class" OfferBox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FC0D62C2-9640-4AEB-A5D5-CF25DF11FA8C}\ = "OfferBox" 64799a0a4118c6ccb56c8c8bd9dae0c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OfferBox.OfferBoxServer\CurVer\ = "OfferBox.OfferBoxServer.1" OfferBox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED85AEBE-F834-4088-B5D3-97EB2478A6CD}\1.0\FLAGS OfferBox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6612AFDD-34AD-4B89-A236-7E6D07C3FDCD}\ProxyStubClsid32 OfferBox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A7E8C343-7860-4A95-9AA8-AAF30D0F6D1E}\TypeLib\ = "{ED85AEBE-F834-4088-B5D3-97EB2478A6CD}" OfferBox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED85AEBE-F834-4088-B5D3-97EB2478A6CD} OfferBox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED85AEBE-F834-4088-B5D3-97EB2478A6CD}\1.0 OfferBox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6612AFDD-34AD-4B89-A236-7E6D07C3FDCD}\TypeLib OfferBox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FC0D62C2-9640-4AEB-A5D5-CF25DF11FA8C} 64799a0a4118c6ccb56c8c8bd9dae0c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OfferBox.OfferBoxServer.1\CLSID\ = "{A7E8C343-7860-4A95-9AA8-AAF30D0F6D1E}" OfferBox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A7E8C343-7860-4A95-9AA8-AAF30D0F6D1E} OfferBox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A7E8C343-7860-4A95-9AA8-AAF30D0F6D1E}\ProgID\ = "OfferBox.OfferBoxServer.1" OfferBox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FC0D62C2-9640-4AEB-A5D5-CF25DF11FA8C}\InProcServer32 64799a0a4118c6ccb56c8c8bd9dae0c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6612AFDD-34AD-4B89-A236-7E6D07C3FDCD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OfferBox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OfferBox.OfferBoxServer.1\CLSID OfferBox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A7E8C343-7860-4A95-9AA8-AAF30D0F6D1E}\Programmable OfferBox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6612AFDD-34AD-4B89-A236-7E6D07C3FDCD}\TypeLib\ = "{ED85AEBE-F834-4088-B5D3-97EB2478A6CD}" OfferBox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OfferBox.OfferBoxServer\CLSID\ = "{A7E8C343-7860-4A95-9AA8-AAF30D0F6D1E}" OfferBox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A7E8C343-7860-4A95-9AA8-AAF30D0F6D1E}\ProgID OfferBox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED85AEBE-F834-4088-B5D3-97EB2478A6CD}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\OfferBox" OfferBox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6612AFDD-34AD-4B89-A236-7E6D07C3FDCD}\ = "IOfferBoxServer" OfferBox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6612AFDD-34AD-4B89-A236-7E6D07C3FDCD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OfferBox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FC0D62C2-9640-4AEB-A5D5-CF25DF11FA8C}\InProcServer32\ThreadingModel = "Apartment" 64799a0a4118c6ccb56c8c8bd9dae0c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OfferBox.OfferBoxServer.1 OfferBox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OfferBox.OfferBoxServer\ = "OfferBoxServer Class" OfferBox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6612AFDD-34AD-4B89-A236-7E6D07C3FDCD} OfferBox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A7E8C343-7860-4A95-9AA8-AAF30D0F6D1E}\VersionIndependentProgID\ = "OfferBox.OfferBoxServer" OfferBox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A7E8C343-7860-4A95-9AA8-AAF30D0F6D1E}\LocalServer32\ = "\"C:\\Program Files (x86)\\OfferBox\\OfferBox.exe\"" OfferBox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED85AEBE-F834-4088-B5D3-97EB2478A6CD}\1.0\FLAGS\ = "0" OfferBox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED85AEBE-F834-4088-B5D3-97EB2478A6CD}\1.0\0\win32 OfferBox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6612AFDD-34AD-4B89-A236-7E6D07C3FDCD}\TypeLib\ = "{ED85AEBE-F834-4088-B5D3-97EB2478A6CD}" OfferBox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OfferBox.OfferBoxServer\CLSID OfferBox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OfferBox.OfferBoxServer\CurVer OfferBox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A7E8C343-7860-4A95-9AA8-AAF30D0F6D1E}\VersionIndependentProgID OfferBox.exe - Suspicious use of FindShellTrayWindow 10 IoCs
pid Process 4424 OfferBox.exe 4424 OfferBox.exe 4424 OfferBox.exe 4424 OfferBox.exe 4424 OfferBox.exe 3868 OfferBox.exe 3868 OfferBox.exe 3868 OfferBox.exe 3868 OfferBox.exe 3868 OfferBox.exe - Suspicious use of SendNotifyMessage 10 IoCs
pid Process 4424 OfferBox.exe 4424 OfferBox.exe 4424 OfferBox.exe 4424 OfferBox.exe 4424 OfferBox.exe 3868 OfferBox.exe 3868 OfferBox.exe 3868 OfferBox.exe 3868 OfferBox.exe 3868 OfferBox.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4424 OfferBox.exe 3868 OfferBox.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1208 wrote to memory of 4424 1208 64799a0a4118c6ccb56c8c8bd9dae0c0.exe 88 PID 1208 wrote to memory of 4424 1208 64799a0a4118c6ccb56c8c8bd9dae0c0.exe 88 PID 1208 wrote to memory of 4424 1208 64799a0a4118c6ccb56c8c8bd9dae0c0.exe 88 PID 1208 wrote to memory of 3756 1208 64799a0a4118c6ccb56c8c8bd9dae0c0.exe 89 PID 1208 wrote to memory of 3756 1208 64799a0a4118c6ccb56c8c8bd9dae0c0.exe 89 PID 1208 wrote to memory of 3756 1208 64799a0a4118c6ccb56c8c8bd9dae0c0.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\64799a0a4118c6ccb56c8c8bd9dae0c0.exe"C:\Users\Admin\AppData\Local\Temp\64799a0a4118c6ccb56c8c8bd9dae0c0.exe"1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Program Files (x86)\OfferBox\OfferBox.exe"C:\Program Files (x86)\OfferBox\OfferBox.exe" /regserver2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4424
-
-
C:\Program Files (x86)\OfferBox\OfferBoxLauncher.exe"C:\Program Files (x86)\OfferBox\OfferBoxLauncher.exe" -register2⤵
- Executes dropped EXE
PID:3756
-
-
C:\Program Files (x86)\OfferBox\OfferBox.exe"C:\Program Files (x86)\OfferBox\OfferBox.exe" -Embedding1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3868
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\OfferBox\OfferBox.exe
- Size 1.9MB
- SHA256 9b1a56f7c746fd7a1c4113040e5c1b7abf90d77db448508989ed85d5bf589881
- MD5 2e33eb8d43cf15ec73e45baa0df06191
- SHA1 34b8c49e032c4dd5f4245d6f2b2386628bd9c927
- SHA512 3c20b01abc639d8f1496ac728af4e58b774e026ce4f146235c5d48d05ed580326bbe040a09639a40bad216e702034e10861d657d3b406a90f10d02a85b16b038
- SSDEEP 49152:Ix6lzqFI7E2Z52MiLC288T8tRcsucD7uaHYDtR+/c0cayU:oZI7EVMb288T8tuxcGaQtROJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\OfferBox\OfferBoxBHO.dll
- Size 131KB
- SHA256 aef0ff4a4c0f589ea4839df6108b92adc024155281860703b28c70581aac6ee6
- MD5 b4b61f417df1f173a78a55e9029be6fb
- SHA1 19facf2bc92cf281b21c704faeda72fdd2909fcf
- SHA512 ee9ad0a9acb8d1ba605aebdc061cbabfd5ad539169dbcef5c569be5e3b014ee7f33ad6313576a1aba4848886ee74f01d565192e06a124814ae1cae9c61b96ef6
- SSDEEP 1536:brWkiTK8yE6Q7ZtbfpCRJt02GPLyRW75JrktWjC4rzHphl+lz54+U65nz677JOEN:/iTKFEdlwmPsgLT1+l++35n2f4Ftb2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\OfferBox\OfferBoxEngine.dll
- Size 1.0MB
- SHA256 ba170abbf00b8a46a64626d30c2f39f2d69f4c7aaa7a0bddb4e2a79160cb2678
- MD5 648bcb283d84f257184bb390d0d3a375
- SHA1 35aeac1459e955f92eeb38074b6f8384843af6a0
- SHA512 f932f7ef1c72a1d2f327a497ad7ffd974fa85e21f67aed3a537c99d674665385751217b2b9fa7ef5c13bfa89a0c9d1c92065d365931335b536974a333896316b
- SSDEEP 12288:tYGPUEJXolX0VuJhq1otALXnoYsXBSYmRVCXeTld2hlovcDhXxT:tmEVshE0XBSYY/TlOlokDJxT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\OfferBox\OfferBoxLauncher.exe
- Size 68KB
- SHA256 2b42fc2b6c09148273326ebee5bdb127bcca81b274028b69b8ca62b4cd8f4eac
- MD5 7d440d531f816402dc37ce1b96b1b6b1
- SHA1 546cec38de6f5fa617d82fd2425ef1ea5bf48897
- SHA512 d2a8801f8a77dadc6e90ff99b60b9a22551c088ec29069e730bf4a940fa6be4f6ec6da0c7fc93a69ad6e3bf7ec24b2e502aacd50ec8033a35581e373546dd484
- SSDEEP 1536:LD4/U+jLGRbb+txkKu5v1xBQZ4O6JV7atyCN2N:4c+uy3u5vXJJV+tby
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nshA3F2.tmp\NsisPluginOB.dll
- Size 239KB
- SHA256 123a2a7b785e24f415a6ebf5e56c807a028d2c45ba7d82f19c4e837b28a6f9db
- MD5 3ee7387bfe2dfabc3bd86f39795bb0da
- SHA1 66071d64229506aad7c802658001725eeab70c02
- SHA512 725c8d940be97b3eb080061c6f413f1676764be1d3cf1e0389550a24e73e694eb51ea2c19f51f1abd654a47cb45b6c3b48cf46f6b8b9d77c7874fd87db0e6c1c
- SSDEEP 6144:Q7YRZ0tknVvtI5j5FBQNC0FyR8I6JjtbD:yZ5j5Ft0FyUV9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\OfferBox\config.xml
- Size 382B
- SHA256 f984248d611f48c5ac9c7b6e9c40dbc7fd39b2b247f9c73a226b7d1856c8b4b7
- MD5 b0523fee0e6b4aa51239b1c2fe19041a
- SHA1 e8aff3ed6c1c00cdceb859fa884d574a5729c7de
- SHA512 29636d5e3da7a83e61fcd741b387eafdaf9a72fba9f4e4858d208c468233f2eaa8d767e963f527923c2aa1ffffb6f4d6c80777490f1c9cab3f9b2e4e3383c9b0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\OfferBox\config.xml
- Size 11B
- SHA256 b40d6e47f206a46eef85dff0a9e238e150fd514e5d3c36e35787d6019404ab8a
- MD5 eaf003049440ae581a82bbe5044fec5a
- SHA1 d27464284670572b4f23b56f607fc5e6c455d804
- SHA512 40b3d3a1e2734b0d7c7cfcbb32fe02ac2ed22bc1ca2e202148f28b25fb2877a5c38316ef9406c2e28b436700ade8a023de200349c3cd07f5d3b2775d7d19b9dc
- MD5 SHA1 SHA512